Reserve 1M IDs per container in mapping

domain-join.sh

@@ -17,25 +17,30 @@ set -euo pipefail
 #
 # Proxmox LXC UID/GID Mapping
 #
-# UID and GID Range per container:
+# LXC user namespace per container:
-#   <cid>0000000 - <cid>9999999
+#   Container IDs 0 - 999999 are mapped to a host-side UID/GID block.
 #
-# Example:
+# Host UID/GID range per container:
-#   CID=150
+#   <ctid>000000 - <ctid>999999
-#   Range=1500000000-1509999999
 #
-# /etc/pve/lxc/<cid>.conf
+# SSSD default ID range inside the container:
-#   lxc.idmap: u 0 <cid>0000000 10000000
+#   100000 - 999999
-#   lxc.idmap: g 0 <cid>0000000 10000000
+#
+# The namespace therefore has enough space for local/system IDs below 100000
+# and for SSSD/AD-mapped IDs from 100000 through 999999.
+#
+# /etc/pve/lxc/<ctid>.conf
+#   lxc.idmap: u 0 <ctid>000000 1000000
+#   lxc.idmap: g 0 <ctid>000000 1000000
 #
 # /etc/subuid
-#   root:<cid>0000000:10000000
+#   root:<ctid>000000:1000000
 #
 # /etc/subgid
-#   root:<cid>0000000:10000000
+#   root:<ctid>000000:1000000
 #
 # Restart:
-#   pct restart <cid>
+#   pct restart <ctid>
 # =============================================================================
 
 # --- Active Directory / Join settings ---
@@ -52,13 +57,15 @@ USE_FQ_NAMES="${USE_FQ_NAMES:-false}"              # true/false: use fully quali
 DISABLE_DNS_AUTOCONFIG="${DISABLE_DNS_AUTOCONFIG:-false}"  # true/false: skip DNS auto config
 
 # --- SSSD ID mapping tuning ---
+LXC_IDMAP_RANGE_SIZE="${LXC_IDMAP_RANGE_SIZE:-1000000}"
 IDMAP_RANGE_MIN="${IDMAP_RANGE_MIN:-100000}"
-IDMAP_RANGE_SIZE="${IDMAP_RANGE_SIZE:-100000}"     # 100k
+IDMAP_RANGE_SIZE="${IDMAP_RANGE_SIZE:-$((LXC_IDMAP_RANGE_SIZE - IDMAP_RANGE_MIN))}"
 # Last ID in the mapping range.
 # Example:
 #   MIN=100000
-#   SIZE=100000
+#   LXC_IDMAP_RANGE_SIZE=1000000
-#   MAX=199999
+#   SIZE=900000
+#   MAX=999999
 IDMAP_RANGE_MAX="${IDMAP_RANGE_MAX:-$((IDMAP_RANGE_MIN + IDMAP_RANGE_SIZE - 1))}"
 
 # --- PAM home directory settings ---
@@ -223,60 +230,34 @@ detect_env() {
   echo "unknown"
 }
 
-detect_proxmox_ctid() {
-  # Best-effort CTID detection from Proxmox LXC mount information.
-  # Typical mountinfo contains strings like "subvol-150-disk-0".
-  local ctid=""
-
-  if [[ -r /proc/1/mountinfo ]]; then
-    ctid="$(grep -oE 'subvol-[0-9]+' /proc/1/mountinfo 2>/dev/null | head -n1 | cut -d '-' -f2 || true)"
-  fi
-
-  if [[ -n "$ctid" && "$ctid" =~ ^[0-9]+$ ]]; then
-    echo "$ctid"
-    return 0
-  fi
-
-  return 1
-}
-
 print_lxc_idmap_host_instructions() {
   # Print host-side Proxmox/LXC idmap guidance for unprivileged containers.
-  local ctid=""
-  local base=""
-  local title=""
-
-  if ctid="$(detect_proxmox_ctid)"; then
-    title="Configuration for detected CTID ${ctid}:"
-  else
-    ctid="150"
-    title="Example for CTID ${ctid}:"
-  fi
-
-  base=$((ctid * 10000000))
-
   cat <<EOF
 
 [!] LXC detected (unprivileged container)
 
-    ${title}
+    Host-side mapping template for Proxmox CTID <ctid>:
 
-    /etc/pve/lxc/${ctid}.conf
+    Host base:
 
-      lxc.idmap: u 0 ${base} 10000000
+      <ctid>000000
-      lxc.idmap: g 0 ${base} 10000000
+
+    /etc/pve/lxc/<ctid>.conf
+
+      lxc.idmap: u 0 <ctid>000000 ${LXC_IDMAP_RANGE_SIZE}
+      lxc.idmap: g 0 <ctid>000000 ${LXC_IDMAP_RANGE_SIZE}
 
     /etc/subuid
 
-      root:${base}:10000000
+      root:<ctid>000000:${LXC_IDMAP_RANGE_SIZE}
 
     /etc/subgid
 
-      root:${base}:10000000
+      root:<ctid>000000:${LXC_IDMAP_RANGE_SIZE}
 
     Restart:
 
-      pct restart ${ctid}
+      pct restart <ctid>
 EOF
 }
 
@@ -602,6 +583,10 @@ configure_sssd() {
     IDMAP_RANGE_MAX="$expected_max"
   fi
 
+  if [[ "$LXC_IDMAP_RANGE_SIZE" -le "$IDMAP_RANGE_MAX" ]]; then
+    die "LXC_IDMAP_RANGE_SIZE (${LXC_IDMAP_RANGE_SIZE}) is too small for container IDs 0..${IDMAP_RANGE_MAX}. It must be at least $((IDMAP_RANGE_MAX + 1))."
+  fi
+
   local cache_credentials_val="false"
   local store_offline_val="false"